aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChao Yu2020-12-09 02:49:36 -0600
committerJaegeuk Kim2020-12-21 15:33:19 -0600
commitde3e65bbe388d19bd3b18cb8379f24ada06918d5 (patch)
tree90efcc1824f5abcde5e5d5396db7aa358b28adbb
parentd4ea8d8b67c4ad489d92ffa53b4681679243b885 (diff)
downloadkernel-de3e65bbe388d19bd3b18cb8379f24ada06918d5.tar.gz
kernel-de3e65bbe388d19bd3b18cb8379f24ada06918d5.tar.xz
kernel-de3e65bbe388d19bd3b18cb8379f24ada06918d5.zip
f2fs: fix shift-out-of-bounds in sanity_check_raw_super()
syzbot reported a bug which could cause shift-out-of-bounds issue, fix it. Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:395 sanity_check_raw_super fs/f2fs/super.c:2812 [inline] read_raw_super_block fs/f2fs/super.c:3267 [inline] f2fs_fill_super.cold+0x16c9/0x16f6 fs/f2fs/super.c:3519 mount_bdev+0x34d/0x410 fs/super.c:1366 legacy_get_tree+0x105/0x220 fs/fs_context.c:592 vfs_get_tree+0x89/0x2f0 fs/super.c:1496 do_new_mount fs/namespace.c:2896 [inline] path_mount+0x12ae/0x1e70 fs/namespace.c:3227 do_mount fs/namespace.c:3240 [inline] __do_sys_mount fs/namespace.c:3448 [inline] __se_sys_mount fs/namespace.c:3425 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3425 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Reported-by: syzbot+ca9a785f8ac472085994@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> Signed-off-by: Chao Yu <yuchao0@huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
-rw-r--r--fs/f2fs/super.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 8a82721b69ef..e8b94bb14bd8 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2775,7 +2775,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
2775 block_t total_sections, blocks_per_seg; 2775 block_t total_sections, blocks_per_seg;
2776 struct f2fs_super_block *raw_super = (struct f2fs_super_block *) 2776 struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
2777 (bh->b_data + F2FS_SUPER_OFFSET); 2777 (bh->b_data + F2FS_SUPER_OFFSET);
2778 unsigned int blocksize;
2779 size_t crc_offset = 0; 2778 size_t crc_offset = 0;
2780 __u32 crc = 0; 2779 __u32 crc = 0;
2781 2780
@@ -2802,10 +2801,10 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
2802 } 2801 }
2803 2802
2804 /* Currently, support only 4KB block size */ 2803 /* Currently, support only 4KB block size */
2805 blocksize = 1 << le32_to_cpu(raw_super->log_blocksize); 2804 if (le32_to_cpu(raw_super->log_blocksize) != F2FS_BLKSIZE_BITS) {
2806 if (blocksize != F2FS_BLKSIZE) { 2805 f2fs_info(sbi, "Invalid log_blocksize (%u), supports only %u",
2807 f2fs_info(sbi, "Invalid blocksize (%u), supports only 4KB", 2806 le32_to_cpu(raw_super->log_blocksize),
2808 blocksize); 2807 F2FS_BLKSIZE_BITS);
2809 return -EFSCORRUPTED; 2808 return -EFSCORRUPTED;
2810 } 2809 }
2811 2810